Add trivy

.github/workflows/build.yaml

@@ -0,0 +1,43 @@
+name: Build ROCK
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_call:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+      - name: Setup LXD
+        uses: canonical/setup-lxd@main
+      - name: Install dependencies
+        run: |
+          sudo snap install yq
+          sudo snap install --classic --channel edge rockcraft
+      - name: Build ROCK
+        id: pack
+        run: |
+          app_version=$(yq '.version' rockcraft.yaml)
+          version=$(yq '(.version|split("-"))[0]' rockcraft.yaml)
+          base=$(yq '(.base|split("@"))[1]' rockcraft.yaml)
+          tag=${version}-${base}_edge
+          rockcraft pack
+          mv charmed-mysql_${version}_amd64.rock charmed-mysql_${tag}_amd64.rock
+      - name: Upload rockcraft logs
+        if: ${{ failure() && steps.pack.outcome == 'failure' }}
+        uses: actions/upload-artifact@v3
+        with:
+          name: rockcraft-build-logs
+          path: ~/.local/state/rockcraft/log/
+          if-no-files-found: error
+      - name: Upload locally built ROCK artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: charmed-mysql-rock
+          path: "charmed-mysql_*.rock"

.github/workflows/publish.yaml

@@ -0,0 +1,50 @@
+name: Publish ROCK
+on:
+  push:
+    branches:
+      - 8.0-22.04
+  workflow_dispatch:
+    branches:
+      - 8.0-22.04
+
+jobs:
+  sbom:
+    uses: ./.github/workflows/sbom.yaml
+  publish:
+    needs: sbom
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+      - name: Setup Docker
+        run: |
+          sudo snap install docker
+          sudo addgroup --system docker; sudo adduser $USER docker
+          newgrp docker
+          sudo snap disable docker; sudo snap enable docker
+      - name: Install skopeo
+        run: |
+          sudo snap install --devmode --channel edge skopeo
+      - name: Install yq
+        run: |
+          sudo snap install yq
+      - uses: actions/download-artifact@v3
+        with:
+          name: charmed-mysql-rock
+      - name: Login to Docker Hub
+        uses: docker/login-action@v1
+        with:
+          registry: ghcr.io
+          username: ${{ secrets.GHCR_USER }}
+          password: ${{ secrets.GHCR_TOKEN }}
+      - name: Push image to GHCR
+        run: |
+          app=$(yq .name rockcraft.yaml)
+          version=$(yq '(.version)' rockcraft.yaml)
+          base=$(yq '(.base|split("@"))[1]' rockcraft.yaml)
+          tag=${version}-${base}_edge
+          sudo skopeo --insecure-policy copy \
+            oci-archive:${app}_${tag}_amd64.rock \
+            docker-daemon:ghcr.io/canonical/${app}:${tag}
+          docker push ghcr.io/canonical/${app}:${tag}

.github/workflows/sbom.yaml

@@ -0,0 +1,32 @@
+name: Generate SBOM
+on:
+  workflow_call:
+
+jobs:
+  build:
+    uses: ./.github/workflows/build.yaml
+  sbom:
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+      - name: Install Syft
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/anchore/syft/4fc17edd146af34ab06f5b0443ef8ddac3aaf076/install.sh | sh -s -- -b /usr/local/bin
+      - name: Set tag
+        run: |
+          version=$(yq '(.version|split("-"))[0]' rockcraft.yaml)
+          base=$(yq '(.base|split("@"))[1]' rockcraft.yaml)
+          echo "tag=${version}-${base}_edge" >> "$GITHUB_ENV"
+      - uses: actions/download-artifact@v3
+        with:
+          name: charmed-mysql-rock
+      - name: Create SBOM
+        run: syft charmed-mysql_${{env.tag}}_amd64.rock -o spdx-json=charmed-mysql_${{env.tag}}_amd64.rock.spdx.json
+      - name: Upload SBOM
+        uses: actions/upload-artifact@v3
+        with:
+          path: "charmed-mysql_${{env.tag}}_amd64.rock.spdx.json"
+          name: charmed-mysql_${{env.tag}}_amd64.rock.spdx.json

.github/workflows/trivy.yaml

@@ -0,0 +1,48 @@
+name: trivy
+on:
+  pull_request:
+  workflow_call:
+  workflow_dispatch:
+jobs:
+  build:
+    uses: ./.github/workflows/build.yaml
+  scan:
+    name: Trivy scan
+    needs: build
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+      - name: Install skopeo
+        run: |
+          sudo snap install --devmode --channel edge skopeo
+      - name: Install yq
+        run: |
+          sudo snap install yq
+      - uses: actions/download-artifact@v3
+        with:
+          name: charmed-mysql-rock
+      - name: Import locally
+        run: |
+          app=$(yq .name rockcraft.yaml)
+          version=$(yq '(.version)' rockcraft.yaml)
+          base=$(yq '(.base|split("@"))[1]' rockcraft.yaml)
+          tag=${version}-${base}_edge
+
+          sudo skopeo --insecure-policy copy \
+            oci-archive:${app}_${tag}_amd64.rock \
+            docker-daemon:trivy/charmed-mysql:test
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: 'trivy/charmed-mysql:test'
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          severity: 'MEDIUM,HIGH,CRITICAL'
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        if: always()
+        with:
+          sarif_file: 'trivy-results.sarif'

rockcraft.yaml

@@ -1,6 +1,6 @@
 name: charmed-mysql
 base: [email protected]
-version: '8.0.37'
+version: '8.0.39'
 summary: Charmed MySQL ROCK OCI
 description: |
     MySQL built from the official MySQL package